Results of 1 - 4 of about 4 for untrusted (0.003 sec.)
- Securing DuckDB 12445
- DuckDB is a powerful analytical database engine. It can read and write files, access the network, load extensions, and use system resources. Like any powerful tool, these capabilities require appropriate configuration when working with sens
...environment, and threat model. If you plan to embed DuckDB in your application, also consult the "Embedding DuckDB" page. Untrusted Input Untrusted SQL Input Warning Treat SQL in DuckDB like code in Bash or Python. Do not execute SQL from untrusted sourc...s of the user running it, much like a shell or scripting interpreter (such as bash or Python). Just as you wouldn't run an untrusted shell script or Python program without sandboxing, apply the same caution to SQL in DuckDB. If your application must execu...te SQL from untrusted sources, use additional safeguards when running untrusted code such as: Use duckdb-wasm for sandboxing Run DuckDB in an is... - https://man.mtool.work/duckdb/2.0/operations_manual/securing_duckdb/overview.htm...
- Securing Extensions 8266
- DuckDB has a powerful extension mechanism, which has the same privileges as the user running DuckDB's (parent) process. This introduces security considerations. Therefore, we recommend reviewing the configuration options listed on this page
...register a harmless-looking DuckDB extension that steals your crypto coins. If you're running a web service that executes untrusted SQL from users with DuckDB, we recommend disabling community extensions. To do so, run: SET allow_community_extensions = f... - https://man.mtool.work/duckdb/2.0/operations_manual/securing_duckdb/securing_ext...
- Expression API 8118
- The Expression class represents an instance of an expression . Why Would I Use the Expression API? Use expressions to build filters and computed columns in Python. They are useful when column names or conditions depend on your code. import
...s the text in as it is. The older SQLExpression(text) also checks that the text is one expression. Never build either from untrusted input. With the sales DataFrame from the top of the page: from duckdb import sql_expr rel = duckdb.from_df(sales) print(re... - https://man.mtool.work/duckdb/2.0/clients/python/expression.html
- Python Client API 8118
- Connection class duckdb. Appender Bases: object append_row ( self , * args ) → None Buffer one row, one value per column, each converted as an executemany parameter would be append_rows ( self , rows : object ) → None Buffer each row of an
...pe = <object object> ) → Expression Cast to a SQL type, a DuckDBPyType , or text spliced in as SQL and so never taken from untrusted input. type is the earlier API's name for the same argument. collate ( collation : str ) → Expression Compare and sort by...b. sql_expr ( sql : str ) → Expression A raw SQL fragment, spliced in unchanged and never escaped, so never build one from untrusted input. duckdb. SQLExpression ( expression : str ) → Expression One SQL expression, checked by the parser here and written...as given, never from untrusted input. An alias in the text names the column, as SQLExpression(“sum(x) AS total”) does; the rest of the text is what the S... - https://man.mtool.work/duckdb/2.0/clients/python/reference/
PREV
1
NEXT
DuckDB 2.0 Documentation / man.mtool.work